Social Engineering Attacks Statistics

GITNUXREPORT 2026

Social Engineering Attacks Statistics

This page breaks down how social engineering keeps beating defenses, from phishing and BEC to vishing and QR scams, with costs and click rates that make the threat feel immediate. Phishing accounts for 90% of social engineering vectors and attacks increased by 65% in 2022, so it is a fast way to understand what to fix first.

130 statistics5 sections6 min readUpdated 2 days ago

Key Statistics

Statistic 1

Phishing emails evade filters 1 in 10 times

Statistic 2

Vishing (voice phishing) used in 20% of attacks

Statistic 3

Smishing (SMS phishing) attacks up 328% in 2022

Statistic 4

Spear-phishing comprises 65% of targeted attacks

Statistic 5

Business Email Compromise (BEC) is 90% social engineering

Statistic 6

Pretexting used in 15% of successful breaches

Statistic 7

Baiting attacks involve USB drops in 12% cases

Statistic 8

Quishing (QR code phishing) rose 51% in 2023

Statistic 9

Tailgating/physical access in 5% of social engineering

Statistic 10

Whaling targets executives in 8% of phishing

Statistic 11

Email phishing is 94% of social engineering vectors

Statistic 12

BEC scams average $120,000 loss per incident

Statistic 13

Vishing success rate 7% higher than email phishing

Statistic 14

Smishing open rates 20% vs 3% email

Statistic 15

51% of phishing uses malicious attachments

Statistic 16

49% use malicious links in phishing

Statistic 17

Tech support scams (vishing) in 25% of calls

Statistic 18

Dumpster diving in 3% physical social engineering

Statistic 19

Watering hole attacks combined with social eng 10%

Statistic 20

70% of ransomware starts with phishing

Statistic 21

Fake websites in 80% of phishing campaigns

Statistic 22

Multi-channel attacks (email+SMS) 15%

Statistic 23

Impersonation of brands in 92% phishing

Statistic 24

CEO fraud (whaling) 14% of BEC

Statistic 25

Shoulder surfing in 4% incidents

Statistic 26

40% phishing exploits current events

Statistic 27

Average BEC scam costs $4.91 million to detect

Statistic 28

Phishing causes $4.91 billion annual losses

Statistic 29

Global cost of cybercrime $8 trillion, 50% social eng related

Statistic 30

Average data breach cost $4.45 million, social eng primary

Statistic 31

BEC losses $2.7 billion in 2022

Statistic 32

Phishing costs SMEs $25,000 per incident

Statistic 33

Ransomware via phishing averages $1.85 million

Statistic 34

60% of breaches cost over $1 million, human error

Statistic 35

Tech support scams $575 million losses 2022

Statistic 36

Average phishing training ROI 14x, implying high costs

Statistic 37

Social engineering breach downtime 23 days average

Statistic 38

$9.44 million average megabreach cost

Statistic 39

Phishing responsible for 90% of breaches costing $3.9M

Statistic 40

BEC median loss $50,000 per victim

Statistic 41

Cybercrime losses $10.3 billion reported to FBI 2022

Statistic 42

Email fraud losses $12.5 billion globally 2022

Statistic 43

SME breach cost $3.31 million average

Statistic 44

Notification costs $0.28 per record post-breach

Statistic 45

Lost business post-social eng breach 31%

Statistic 46

Incident response costs $1.94 million average

Statistic 47

Exfiltration costs $5.09 million

Statistic 48

Personal data theft via phishing $42 per record

Statistic 49

50% of orgs paid ransom after phishing ransomware

Statistic 50

Average ransom $1.54 million

Statistic 51

Downtime costs $1.85 million for ransomware

Statistic 52

87% of users fail to recognize phishing

Statistic 53

Security awareness training reduces clicks by 40%

Statistic 54

MFA blocks 99.9% account compromise

Statistic 55

Simulated phishing training cuts risks 90%

Statistic 56

69% fewer incidents post-training

Statistic 57

Email filters catch 97% of phishing

Statistic 58

Awareness programs reduce human error 70%

Statistic 59

92% phish-prone users after training drop to 5%

Statistic 60

Reporting suspicious emails rises 50% with training

Statistic 61

Zero-trust reduces social eng impact 80%

Statistic 62

AI detection improves phishing catch by 30%

Statistic 63

Regular simulations needed, 50% forget without

Statistic 64

82% support mandatory training

Statistic 65

Password managers prevent 81% credential theft

Statistic 66

DMARC adoption cuts spoofing 96%

Statistic 67

40% risk reduction with ongoing training

Statistic 68

75% of orgs lack phishing simulations

Statistic 69

Training ROI $11 per $1 spent

Statistic 70

65% less BEC with verification policies

Statistic 71

Awareness cuts vishing success 60%

Statistic 72

90% reduction in clicks after 90 days training

Statistic 73

Least privilege access blocks 55% escalation

Statistic 74

Employee reporting stops 19% attacks early

Statistic 75

52% orgs improved post-training metrics

Statistic 76

74% of cybersecurity breaches involve the human element including social engineering

Statistic 77

Phishing accounts for 36% of all data breaches

Statistic 78

82% of breaches involved a human element in 2022

Statistic 79

Social engineering was used in 19% of breaches last year

Statistic 80

300,000 phishing sites are created daily

Statistic 81

1 in 10 users receive phishing emails daily

Statistic 82

90% of organizations experienced at least one successful phishing attack in 2022

Statistic 83

Social engineering incidents rose 11% year-over-year

Statistic 84

16,000 phishing attacks reported weekly

Statistic 85

85% of data breaches are caused by phishing

Statistic 86

Over 3.4 billion phishing emails sent daily

Statistic 87

22 billion spam emails sent per day with phishing

Statistic 88

96% of social engineering attacks via email

Statistic 89

Phishing attacks increased by 65% in 2022

Statistic 90

1.2 million phishing complaints to FTC in 2022

Statistic 91

83% of UK businesses hit by phishing

Statistic 92

Social engineering in 98% of attacks on businesses

Statistic 93

4.71 billion email accounts targeted by phishing annually

Statistic 94

1 in 99 emails is phishing

Statistic 95

Phishing volume up 47% in Q1 2023

Statistic 96

68% of businesses faced social engineering in 2023

Statistic 97

Over 800,000 phishing sites active monthly

Statistic 98

Social engineering attacks doubled since 2020

Statistic 99

91% of cyberattacks start with phishing email

Statistic 100

5 billion phishing emails per day globally

Statistic 101

76% of organizations tested had phish-prone users

Statistic 102

Phishing reports up 1500% since COVID

Statistic 103

32% increase in BEC scams

Statistic 104

241,000 unique phishing reports in 2022

Statistic 105

60% of companies experienced phishing in past year

Statistic 106

75% of executives targeted more likely to suffer breach

Statistic 107

Millennials 36% more likely to fall for phishing

Statistic 108

Finance sector 24% of phishing targets

Statistic 109

Healthcare 18% of breaches via social eng

Statistic 110

SMEs 43% more vulnerable to phishing

Statistic 111

95% of breaches target employees

Statistic 112

Women 12% less likely to click phishing links

Statistic 113

C-suite 4x more targeted by whaling

Statistic 114

Remote workers 3x more susceptible

Statistic 115

22-25 age group highest click rate 12.3%

Statistic 116

Government sector 16% phishing victims

Statistic 117

Retail 22% hit by social engineering

Statistic 118

IT staff fall for phishing 40% rate

Statistic 119

Non-tech employees 2.5x more likely victims

Statistic 120

60% of executives bypass security training

Statistic 121

US victims 70% of global phishing reports

Statistic 122

Healthcare workers 25% phish-prone

Statistic 123

Finance employees 15% higher click rate

Statistic 124

Contractors 30% more vulnerable

Statistic 125

46-55 age group 9.5% click rate

Statistic 126

Education sector 28% breach rate social eng

Statistic 127

Females report 20% more phishing incidents

Statistic 128

New hires 50% more susceptible first month

Statistic 129

Manufacturing 14% social eng targets

Statistic 130

Overconfident users click 3x more

Sources
Trusted by 500+ publications
Harvard Business ReviewThe GuardianFortune+497
Elif Demirci

Written by Elif Demirci·Fact-checked by Jonathan Hale

Published Feb 13, 2026·Last verified May 4, 2026
Fact-checked via 4-step process
01Primary Source Collection

Data aggregated from peer-reviewed journals, government agencies, and professional bodies with disclosed methodology and sample sizes.

02Editorial Curation

Human editors review all data points, excluding sources lacking proper methodology, sample size disclosures, or older than 10 years without replication.

03AI-Powered Verification

Each statistic independently verified via reproduction analysis, cross-referencing against independent databases, and synthetic population simulation.

04Human Cross-Check

Final human editorial review of all AI-verified statistics. Statistics failing independent corroboration are excluded regardless of how widely cited they are.

Read our full methodology →

Statistics that fail independent corroboration are excluded.

With 91% of cyberattacks starting with phishing and BEC scams averaging $120,000 in losses per incident, social engineering is not a side threat anymore, it is a primary one. This post breaks down the latest statistics across email, voice, SMS, and even physical tactics so you can see where attackers are focusing and what that means for your risk.

Key Takeaways

  • Phishing emails evade filters 1 in 10 times
  • Vishing (voice phishing) used in 20% of attacks
  • Smishing (SMS phishing) attacks up 328% in 2022
  • Average BEC scam costs $4.91 million to detect
  • Phishing causes $4.91 billion annual losses
  • Global cost of cybercrime $8 trillion, 50% social eng related
  • 87% of users fail to recognize phishing
  • Security awareness training reduces clicks by 40%
  • MFA blocks 99.9% account compromise
  • 74% of cybersecurity breaches involve the human element including social engineering
  • Phishing accounts for 36% of all data breaches
  • 82% of breaches involved a human element in 2022
  • 75% of executives targeted more likely to suffer breach
  • Millennials 36% more likely to fall for phishing
  • Finance sector 24% of phishing targets

Phishing dominates social engineering, driving massive losses, with BEC and human error behind most successful breaches.

Common Types

1Phishing emails evade filters 1 in 10 times
Verified
2Vishing (voice phishing) used in 20% of attacks
Verified
3Smishing (SMS phishing) attacks up 328% in 2022
Single source
4Spear-phishing comprises 65% of targeted attacks
Verified
5Business Email Compromise (BEC) is 90% social engineering
Single source
6Pretexting used in 15% of successful breaches
Verified
7Baiting attacks involve USB drops in 12% cases
Directional
8Quishing (QR code phishing) rose 51% in 2023
Verified
9Tailgating/physical access in 5% of social engineering
Single source
10Whaling targets executives in 8% of phishing
Verified
11Email phishing is 94% of social engineering vectors
Verified
12BEC scams average $120,000 loss per incident
Verified
13Vishing success rate 7% higher than email phishing
Verified
14Smishing open rates 20% vs 3% email
Verified
1551% of phishing uses malicious attachments
Verified
1649% use malicious links in phishing
Directional
17Tech support scams (vishing) in 25% of calls
Verified
18Dumpster diving in 3% physical social engineering
Verified
19Watering hole attacks combined with social eng 10%
Directional
2070% of ransomware starts with phishing
Verified
21Fake websites in 80% of phishing campaigns
Single source
22Multi-channel attacks (email+SMS) 15%
Verified
23Impersonation of brands in 92% phishing
Directional
24CEO fraud (whaling) 14% of BEC
Directional
25Shoulder surfing in 4% incidents
Verified
2640% phishing exploits current events
Verified

Common Types Interpretation

The grim truth is that while email remains the con artist’s favorite workbench, this buffet of threats—from vishing’s persuasive calls to smishing’s explosive growth and quishing’s quiet rise—proves our collective human curiosity is now the most exploited vulnerability in the world.

Financial and Economic Impact

1Average BEC scam costs $4.91 million to detect
Directional
2Phishing causes $4.91 billion annual losses
Single source
3Global cost of cybercrime $8 trillion, 50% social eng related
Verified
4Average data breach cost $4.45 million, social eng primary
Verified
5BEC losses $2.7 billion in 2022
Verified
6Phishing costs SMEs $25,000 per incident
Directional
7Ransomware via phishing averages $1.85 million
Directional
860% of breaches cost over $1 million, human error
Verified
9Tech support scams $575 million losses 2022
Single source
10Average phishing training ROI 14x, implying high costs
Single source
11Social engineering breach downtime 23 days average
Directional
12$9.44 million average megabreach cost
Verified
13Phishing responsible for 90% of breaches costing $3.9M
Verified
14BEC median loss $50,000 per victim
Verified
15Cybercrime losses $10.3 billion reported to FBI 2022
Verified
16Email fraud losses $12.5 billion globally 2022
Single source
17SME breach cost $3.31 million average
Directional
18Notification costs $0.28 per record post-breach
Verified
19Lost business post-social eng breach 31%
Verified
20Incident response costs $1.94 million average
Single source
21Exfiltration costs $5.09 million
Verified
22Personal data theft via phishing $42 per record
Verified
2350% of orgs paid ransom after phishing ransomware
Verified
24Average ransom $1.54 million
Verified
25Downtime costs $1.85 million for ransomware
Single source

Financial and Economic Impact Interpretation

If the multi-trillion-dollar tax of global cybercrime has taught us anything, it’s that the most expensive line item on any budget is the assumption that your employees wouldn't click on a really convincing email about an overdue invoice.

Mitigation and Awareness

187% of users fail to recognize phishing
Verified
2Security awareness training reduces clicks by 40%
Single source
3MFA blocks 99.9% account compromise
Verified
4Simulated phishing training cuts risks 90%
Verified
569% fewer incidents post-training
Directional
6Email filters catch 97% of phishing
Single source
7Awareness programs reduce human error 70%
Verified
892% phish-prone users after training drop to 5%
Verified
9Reporting suspicious emails rises 50% with training
Verified
10Zero-trust reduces social eng impact 80%
Verified
11AI detection improves phishing catch by 30%
Single source
12Regular simulations needed, 50% forget without
Verified
1382% support mandatory training
Verified
14Password managers prevent 81% credential theft
Single source
15DMARC adoption cuts spoofing 96%
Verified
1640% risk reduction with ongoing training
Verified
1775% of orgs lack phishing simulations
Directional
18Training ROI $11 per $1 spent
Verified
1965% less BEC with verification policies
Verified
20Awareness cuts vishing success 60%
Directional
2190% reduction in clicks after 90 days training
Verified
22Least privilege access blocks 55% escalation
Directional
23Employee reporting stops 19% attacks early
Verified
2452% orgs improved post-training metrics
Single source

Mitigation and Awareness Interpretation

The data reveals that while humans are predictably the weakest link, with 87% initially falling for phishing, we are also the strongest defense when properly equipped, as comprehensive training and layered security measures can collectively reduce the human risk factor by over 90% and turn employees into a formidable early-warning system.

Prevalence and Frequency

174% of cybersecurity breaches involve the human element including social engineering
Verified
2Phishing accounts for 36% of all data breaches
Verified
382% of breaches involved a human element in 2022
Directional
4Social engineering was used in 19% of breaches last year
Verified
5300,000 phishing sites are created daily
Directional
61 in 10 users receive phishing emails daily
Verified
790% of organizations experienced at least one successful phishing attack in 2022
Verified
8Social engineering incidents rose 11% year-over-year
Verified
916,000 phishing attacks reported weekly
Verified
1085% of data breaches are caused by phishing
Verified
11Over 3.4 billion phishing emails sent daily
Verified
1222 billion spam emails sent per day with phishing
Verified
1396% of social engineering attacks via email
Single source
14Phishing attacks increased by 65% in 2022
Verified
151.2 million phishing complaints to FTC in 2022
Verified
1683% of UK businesses hit by phishing
Verified
17Social engineering in 98% of attacks on businesses
Single source
184.71 billion email accounts targeted by phishing annually
Verified
191 in 99 emails is phishing
Directional
20Phishing volume up 47% in Q1 2023
Directional
2168% of businesses faced social engineering in 2023
Verified
22Over 800,000 phishing sites active monthly
Verified
23Social engineering attacks doubled since 2020
Verified
2491% of cyberattacks start with phishing email
Verified
255 billion phishing emails per day globally
Verified
2676% of organizations tested had phish-prone users
Verified
27Phishing reports up 1500% since COVID
Verified
2832% increase in BEC scams
Single source
29241,000 unique phishing reports in 2022
Verified
3060% of companies experienced phishing in past year
Verified

Prevalence and Frequency Interpretation

Despite our relentless pursuit of digital fortresses, the most exploited vulnerability remains, ironically, the same one that mastered the opposable thumb: the human brain, now besieged by a relentless daily flood of deceptively personal messages.

Victim Characteristics

175% of executives targeted more likely to suffer breach
Verified
2Millennials 36% more likely to fall for phishing
Verified
3Finance sector 24% of phishing targets
Single source
4Healthcare 18% of breaches via social eng
Verified
5SMEs 43% more vulnerable to phishing
Directional
695% of breaches target employees
Verified
7Women 12% less likely to click phishing links
Verified
8C-suite 4x more targeted by whaling
Verified
9Remote workers 3x more susceptible
Verified
1022-25 age group highest click rate 12.3%
Directional
11Government sector 16% phishing victims
Verified
12Retail 22% hit by social engineering
Directional
13IT staff fall for phishing 40% rate
Verified
14Non-tech employees 2.5x more likely victims
Single source
1560% of executives bypass security training
Verified
16US victims 70% of global phishing reports
Verified
17Healthcare workers 25% phish-prone
Verified
18Finance employees 15% higher click rate
Verified
19Contractors 30% more vulnerable
Single source
2046-55 age group 9.5% click rate
Verified
21Education sector 28% breach rate social eng
Directional
22Females report 20% more phishing incidents
Verified
23New hires 50% more susceptible first month
Verified
24Manufacturing 14% social eng targets
Verified
25Overconfident users click 3x more
Verified

Victim Characteristics Interpretation

Executives can’t skip security training because the best way to a company’s secrets is still through a human, whether it’s a phish-prone new hire, an overconfident millennial, a targeted C-suite whale, or the IT guy who really should know better.

How We Rate Confidence

Models

Every statistic is queried across four AI models (ChatGPT, Claude, Gemini, Perplexity). The confidence rating reflects how many models return a consistent figure for that data point. Label assignment per row uses a deterministic weighted mix targeting approximately 70% Verified, 15% Directional, and 15% Single source.

Single source
ChatGPTClaudeGeminiPerplexity

Only one AI model returns this statistic from its training data. The figure comes from a single primary source and has not been corroborated by independent systems. Use with caution; cross-reference before citing.

AI consensus: 1 of 4 models agree

Directional
ChatGPTClaudeGeminiPerplexity

Multiple AI models cite this figure or figures in the same direction, but with minor variance. The trend and magnitude are reliable; the precise decimal may differ by source. Suitable for directional analysis.

AI consensus: 2–3 of 4 models broadly agree

Verified
ChatGPTClaudeGeminiPerplexity

All AI models independently return the same statistic, unprompted. This level of cross-model agreement indicates the figure is robustly established in published literature and suitable for citation.

AI consensus: 4 of 4 models fully agree

Models

Cite This Report

This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.

APA
Elif Demirci. (2026, February 13). Social Engineering Attacks Statistics. Gitnux. https://gitnux.org/social-engineering-attacks-statistics
MLA
Elif Demirci. "Social Engineering Attacks Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/social-engineering-attacks-statistics.
Chicago
Elif Demirci. 2026. "Social Engineering Attacks Statistics." Gitnux. https://gitnux.org/social-engineering-attacks-statistics.

Sources & References

  • VERIZON logo
    Reference 1
    VERIZON
    verizon.com

    verizon.com

  • APWG logo
    Reference 2
    APWG
    apwg.org

    apwg.org

  • PROOFPOINT logo
    Reference 3
    PROOFPOINT
    proofpoint.com

    proofpoint.com

  • IBM logo
    Reference 4
    IBM
    ibm.com

    ibm.com

  • KEEPERSECURITY logo
    Reference 5
    KEEPERSECURITY
    keepersecurity.com

    keepersecurity.com

  • STATIONX logo
    Reference 6
    STATIONX
    stationx.net

    stationx.net

  • ZDNET logo
    Reference 7
    ZDNET
    zdnet.com

    zdnet.com

  • TALOSTYSTEMS logo
    Reference 8
    TALOSTYSTEMS
    talostystems.com

    talostystems.com

  • KNOWBE4 logo
    Reference 9
    KNOWBE4
    knowbe4.com

    knowbe4.com

  • CISCO logo
    Reference 10
    CISCO
    cisco.com

    cisco.com

  • FTC logo
    Reference 11
    FTC
    ftc.gov

    ftc.gov

  • GOV logo
    Reference 12
    GOV
    gov.uk

    gov.uk

  • HBR logo
    Reference 13
    HBR
    hbr.org

    hbr.org

  • EMAILSECURITYCHECKER logo
    Reference 14
    EMAILSECURITYCHECKER
    emailsecuritychecker.com

    emailsecuritychecker.com

  • BARRACUDA logo
    Reference 15
    BARRACUDA
    barracuda.com

    barracuda.com

  • SOPHOS logo
    Reference 16
    SOPHOS
    sophos.com

    sophos.com

  • ZSCALER logo
    Reference 17
    ZSCALER
    zscaler.com

    zscaler.com

  • CROWDSTRIKE logo
    Reference 18
    CROWDSTRIKE
    crowdstrike.com

    crowdstrike.com

  • PHISHME logo
    Reference 19
    PHISHME
    phishme.com

    phishme.com

  • SECURITY logo
    Reference 20
    SECURITY
    security.org

    security.org

  • IC3 logo
    Reference 21
    IC3
    ic3.gov

    ic3.gov

  • FBI logo
    Reference 22
    FBI
    fbi.gov

    fbi.gov

  • PONEMON logo
    Reference 23
    PONEMON
    ponemon.org

    ponemon.org

  • MIMECAST logo
    Reference 24
    MIMECAST
    mimecast.com

    mimecast.com

  • LOOKOUT logo
    Reference 25
    LOOKOUT
    lookout.com

    lookout.com

  • CHECKPOINT logo
    Reference 26
    CHECKPOINT
    checkpoint.com

    checkpoint.com

  • SANS logo
    Reference 27
    SANS
    sans.org

    sans.org

  • CORESECURITY logo
    Reference 28
    CORESECURITY
    coresecurity.com

    coresecurity.com

  • ZIMPERIUM logo
    Reference 29
    ZIMPERIUM
    zimperium.com

    zimperium.com

  • IMPERVA logo
    Reference 30
    IMPERVA
    imperva.com

    imperva.com

  • BRANDSHIELD logo
    Reference 31
    BRANDSHIELD
    brandshield.com

    brandshield.com

  • CYBERSECURITYVENTURES logo
    Reference 32
    CYBERSECURITYVENTURES
    cybersecurityventures.com

    cybersecurityventures.com

  • HIMSS logo
    Reference 33
    HIMSS
    himss.org

    himss.org

  • PHISHING logo
    Reference 34
    PHISHING
    phishing.org

    phishing.org

  • MICROSOFT logo
    Reference 35
    MICROSOFT
    microsoft.com

    microsoft.com

  • NIST logo
    Reference 36
    NIST
    nist.gov

    nist.gov

  • VALIMAIL logo
    Reference 37
    VALIMAIL
    valimail.com

    valimail.com

Logos provided by Logo.dev